Luxembourg Cloud Computing Adoption Survey 2022

50 institutions present in Luxembourg answered a questionnaire containing a series of about 40 questions between December 2021 and February 2022. The majority of respondents were banking institutions, with 35 respondents; 12 of them with more than 500 full-time equivalents working in Luxembourg, thereby ensuring a representative sample of the larger players present in our market.

A first edition of this survey was successfully conducted in 2019. Since then, the Luxembourg cloud landscape has changed significantly (update of CSSF circulars, COVID-19, implementation of the EBA Guidelines on outsourcing, etc.). There has also been a growing demand from ABBL members for information related to the approval of specific cloud computing services, statistics on cloud adoption use cases, criticality / materiality assessment, etc.

In this context, the second edition of this survey intends to capture market insights on overall cloud computing adoption drivers as well as issues; strategy and governance; detailed information on Infrastructure and/or Platform as a Service use cases; information on Software as a Service use case(s); and IT architecture and information security considerations.

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction. Cloud computing service models are generally categorized as follows:

• Infrastructure as a Service (“IaaS”) which is a type of cloud computing service that offers essential compute, storage, and networking resources on demand, on a pay-as-you-go basis;
• Platform as a Service (“PaaS”) which is a complete development and deployment environment in the cloud, with resources that enable financial institutions to deliver everything from simple cloud-based apps to sophisticated, cloud-enabled enterprise applications; and
• Software as a Service (“SaaS”) which allows users to connect to and use cloud-based apps over the Internet.

This survey’s results show that these concepts are being translated into reality by financial institutions in Luxembourg with respectively 70% and 85% of respondents having adopted (or planning to adopt) cloud services for IaaS and/or PaaS use cases and SaaS use cases.

As announced in its 2020 annual report, the CSSF reflected on the objectives and organization of its IT risk supervisory activity and has defined a new strategy, the implementation of which started in October 2021 with the publication of Circular CSSF 21/785 (few weeks before we launched our questionnaire for the present survey and recently repealed in favor of Circular CSSF 22/806). The circular introduced the replacement of the prior authorization obligation by a prior notification obligation in the case of critical / material IT outsourcing. Since then, supervised entities have had to notify the CSSF of their critical / material cloud computing projects at least three months before the planned outsourcing becomes effective.

In our experience, this new pragmatic approach has allowed local market players to clarify the timelines of their transformation projects. Let’s hope for this important evolution in the regulatory dialogue to further support the adoption of cloud computing in Luxembourg.